Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 858107 (CVE-2022-32317) - media-video/mplayer: heap use after free?
Summary: media-video/mplayer: heap use after free?
Status: RESOLVED INVALID
Alias: CVE-2022-32317
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-07-15 02:49 UTC by John Helmert III
Modified: 2023-01-26 16:38 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
poc (poc_dup.zip,528.14 KB, application/x-zip-compressed)
2022-09-19 16:07 UTC, BitFriends
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-07-15 02:49:14 UTC
CVE-2022-32317 (https://transfer.sh/m2WcuM/poc_dup.zip):

The MPlayer Project v1.5 was discovered to contain a heap use-after-free resulting in a double free in the preinit function at libvo/vo_v4l2.c. This vulnerability can lead to a Denial of Service (DoS) via a crafted file.

The sole reference 404's for me. No idea if this is real, reported
upstream, or patched at all. Not sure how MITRE handled this.
Comment 1 BitFriends 2022-09-19 16:07:46 UTC
Created attachment 812869 [details]
poc
Comment 2 BitFriends 2022-09-19 16:09:11 UTC
Yes, it is real. MITRE didn't reply to my email with the updated link. Here is the poc. It is also on github repo b17fr13nds/MPlayer_cve_poc
Comment 3 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-09-19 16:11:56 UTC
(In reply to BitFriends from comment #2)
> Yes, it is real. MITRE didn't reply to my email with the updated link. Here
> is the poc. It is also on github repo b17fr13nds/MPlayer_cve_poc

Have you reported it upstream?
Comment 4 Larry the Git Cow gentoo-dev 2022-12-24 10:21:35 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8cdb49a98ff943afe53695735fb3eed4b77c3b28

commit 8cdb49a98ff943afe53695735fb3eed4b77c3b28
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2022-12-24 10:16:46 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-12-24 10:19:57 +0000

    media-video/mplayer: add 1.5
    
    Unclear if anything happened with security bug #858107 though.
    
    Bug: https://bugs.gentoo.org/858107
    Bug: https://bugs.gentoo.org/870406
    Closes: https://bugs.gentoo.org/728640
    Closes: https://bugs.gentoo.org/836428
    Closes: https://bugs.gentoo.org/870649
    Closes: https://bugs.gentoo.org/888073
    Signed-off-by: Sam James <sam@gentoo.org>

 media-video/mplayer/Manifest            |   1 +
 media-video/mplayer/mplayer-1.5.ebuild  | 627 ++++++++++++++++++++++++++++++++
 media-video/mplayer/mplayer-9999.ebuild | 378 ++++++++++---------
 3 files changed, 829 insertions(+), 177 deletions(-)
Comment 5 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2023-01-26 16:38:56 UTC
Well, I can't reproduce.

Reporter: please don't waste everyone's time by requesting CVEs without reporting upstream.